Best Practices Guide
Board Response to an AI Incident in the First 24 Hours
In the first 24 hours of an AI incident, the board should confirm it was notified through a defined escalation path, require a scoped account of what happened, confirm that management has contained the system, ensure evidence is preserved, ensure legal and regulatory assessment is under way, and record its questions and decisions. The board oversees these steps and does not perform them. Doing this well depends on runtime evidence, such as agent identity, permissions, tool-call logs, and policy enforcement records, being available before the incident.
Oversight is not operational response
In the first 24 hours, the board's role is to confirm, require, and ensure. Management and technical teams carry out the response. The board oversees these steps and does not perform them, and it records its own questions and decisions along the way.
| Stage | What the board does |
|---|---|
| Notification and escalation | Confirm the defined path was followed and an accountable executive is named. |
| Scoping | Require a written account separating what is known from what is not. |
| Containment confirmation | Ask management to confirm the agent can no longer cause harm. |
| Evidence preservation | Require that logs and configurations are retained before remediation alters them. |
| Legal assessment and records | Oversee disclosure analysis and document decisions and rationale. |
Notification, escalation, scoping, and containment
Notification and escalation
The board should confirm it was notified through a defined escalation path. Confirm the defined path was followed and an accountable executive is named.
Scoping
The board should require a scoped account of what happened. Require a written account separating what is known from what is not.
Containment confirmation
The board should confirm that management has contained the system. Ask management to confirm the agent can no longer cause harm.
Evidence preservation
The board should ensure evidence is preserved. Require that logs and configurations are retained before remediation alters them.
Legal and regulatory assessment, and decision records
The board should ensure legal and regulatory assessment is under way. Oversee disclosure analysis, and document decisions and rationale.
The board should also record its questions and decisions, so that the record shows what it asked, what it decided, and why.
Where runtime governance fits
Doing this well depends on runtime evidence being available before the incident. That evidence includes agent identity, permissions, tool-call logs, and policy enforcement records.
What must be in place before an incident
- A defined escalation path that reaches the board.
- An accountable executive who can be named when an incident is escalated.
- Agent identity records.
- Permission records.
- Tool-call logs.
- Policy enforcement records.
- Logs and configurations that can be retained before remediation alters them.
Confirm your evidence is ready before the board needs it
Talk with our team about how runtime policy enforcement and audit logging can supply agent identity, permission, and tool-call records for board-level oversight.
Talk to an Expert